CVE-2014-8835
HighSummary
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type. This allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an 'XPC type confusion' issue.
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a serious threat to system security and user data.
Recommendation
It is recommended to update the system to version 10.10.2 or later to mitigate this vulnerability and to monitor the system for unauthorized activities.
Other vulnerabilities in libxpc
See all- CVE-2017-7047High
An issue was discovered in certain Apple products related to the 'libxpc' component, allowing attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- CVE-2016-4675High
An issue was discovered in certain Apple products related to the 'libxpc' component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.
- CVE-2016-4617High
An issue was discovered in certain Apple products, including macOS before 10.12, involving a sandbox escape related to launchctl process spawning in the 'libxpc' component.
- CVE-2015-3795High
libxpc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app that sends a malformed XPC message.
Original NVD description (English source)
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type, which allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an "XPC type confusion" issue.